You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by jo...@apache.org on 2022/10/19 16:23:12 UTC

[impala] 02/03: IMPALA-11667: Clean up Java dependency exclusions

This is an automated email from the ASF dual-hosted git repository.

joemcdonnell pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git

commit 22e5ca3d0a891373251a4f08f3c3824491336e34
Author: Michael Smith <mi...@cloudera.com>
AuthorDate: Mon Oct 17 11:38:14 2022 -0700

    IMPALA-11667: Clean up Java dependency exclusions
    
    Use dependencyManagement to simplify Java dependencies by directly
    controlling versions of transitive dependencies instead of using
    exclusions and direct inclusion.
    
    Dependency management specifies versions authoritatively, so redundant
    version declarations are also removed.
    
    Change-Id: I424a175135855dcbd38ae432ea111cca5f562633
    Reviewed-on: http://gerrit.cloudera.org:8080/19146
    Reviewed-by: Joe McDonnell <jo...@cloudera.com>
    Tested-by: Joe McDonnell <jo...@cloudera.com>
---
 fe/pom.xml                          | 118 +-----------------------------------
 java/TableFlattener/pom.xml         |  10 ---
 java/datagenerator/pom.xml          |  36 -----------
 java/executor-deps/pom.xml          |  35 -----------
 java/ext-data-source/sample/pom.xml |   1 -
 java/ext-data-source/test/pom.xml   |   1 -
 java/pom.xml                        | 111 ++++++++++++++++++++++++++++++++-
 java/shaded-deps/hive-exec/pom.xml  |  13 ----
 java/test-hive-udfs/pom.xml         |  19 ------
 java/yarn-extras/pom.xml            |  24 --------
 10 files changed, 112 insertions(+), 256 deletions(-)

diff --git a/fe/pom.xml b/fe/pom.xml
index a2f59c912..2cc39e6be 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -33,13 +33,6 @@ under the License.
   <name>Apache Impala Query Engine Frontend</name>
 
   <dependencies>
-    <!-- Pin json-smart dependency. -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.impala</groupId>
       <artifactId>impala-executor-deps</artifactId>
@@ -64,15 +57,6 @@ under the License.
       <artifactId>hadoop-auth</artifactId>
       <version>${hadoop.version}</version>
       <exclusions>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>log4j</groupId>
           <artifactId>log4j</artifactId>
@@ -90,14 +74,6 @@ under the License.
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>fluent-hc</artifactId>
           </exclusion>
-          <exclusion>
-            <groupId>org.apache.parquet</groupId>
-            <artifactId>parquet-avro</artifactId>
-          </exclusion>
-          <exclusion>
-            <groupId>org.apache.avro</groupId>
-            <artifactId>*</artifactId>
-          </exclusion>
           <exclusion>
             <groupId>org.apache.hadoop</groupId>
             <artifactId>*</artifactId>
@@ -122,11 +98,6 @@ under the License.
         <!-- Ranger jar also includes solr artifacts which we not exclude here since
         they are used during the instantiation of RangerAuthorizationFactory
         (See IMPALA-10644 for more details. -->
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <!-- We need to exclude ranger-plugins-audit here, or the build will fail
         to resolve dependencies for cruise-control-metrics-reporter, which is
         unneeded and not uploaded to toolchain. -->
@@ -179,11 +150,6 @@ under the License.
         We do not explicitly exclude all artifacts in org.eclipse.jetty because
         jetty-client is needed.
         -->
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <!-- We exclude hive-exec which this jar includes because hive-exec
         brings with it tons of other unnecessary dependencies including thrift 0.9.3
         which can cause build failures.
@@ -239,7 +205,6 @@ under the License.
     <dependency>
       <groupId>org.apache.avro</groupId>
       <artifactId>avro</artifactId>
-      <version>${avro.version}</version>
     </dependency>
 
     <dependency>
@@ -280,22 +245,6 @@ under the License.
       <groupId>org.apache.thrift</groupId>
       <artifactId>libthrift</artifactId>
       <version>${thrift.version}</version>
-      <!-- httpcore overriden below -->
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.httpcomponents</groupId>
-          <artifactId>httpcore</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-
-    <!-- Override httpcore from libthrift to a later maintenance version. Noticed
-        certain SPNEGO auth errors when connecting to kerberized HTTP endpoints
-        using v4.4.1 pulled by libthrift. -->
-    <dependency>
-      <groupId>org.apache.httpcomponents</groupId>
-      <artifactId>httpcore</artifactId>
-      <version>${httpcomponents.core.version}</version>
     </dependency>
 
     <dependency>
@@ -323,22 +272,9 @@ under the License.
       <version>1.2</version>
     </dependency>
 
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
-      <version>${slf4j.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-reload4j</artifactId>
-      <version>${slf4j.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>com.google.guava</groupId>
-      <artifactId>guava</artifactId>
-      <version>${guava.version}</version>
     </dependency>
 
     <dependency>
@@ -484,11 +420,6 @@ under the License.
           <groupId>io.netty</groupId>
           <artifactId>*</artifactId>
         </exclusion>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
@@ -511,11 +442,6 @@ under the License.
           <groupId>org.apache.logging.log4j</groupId>
           <artifactId>log4j-1.2-api</artifactId>
         </exclusion>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.apache.hive</groupId>
           <artifactId>hive-serde</artifactId>
@@ -584,16 +510,6 @@ under the License.
           <groupId>org.javassist</groupId>
           <artifactId>javassist</artifactId>
         </exclusion>
-        <exclusion>
-          <!-- The dependency included in pac4j is old and has known CVEs.
-          We exclude it from here and add a separate dependency down below.-->
-          <groupId>org.bouncycastle</groupId>
-          <artifactId>org.bouncycastle</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.santuario</groupId>
-          <artifactId>xmlsec</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>commons-collections</groupId>
           <artifactId>commons-collections</artifactId>
@@ -608,20 +524,9 @@ under the License.
         </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk15on</artifactId>
-      <version>${bcprov-jdk15on.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.santuario</groupId>
-      <artifactId>xmlsec</artifactId>
-      <version>${xmlsec.version}</version>
-    </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>${springframework.version}</version>
     </dependency>
   </dependencies>
 
@@ -863,10 +768,10 @@ under the License.
                     <exclude>ant-contrib:*</exclude>
                     <exclude>org.apache.ant:*</exclude>
                     <exclude>org.eclipse.jetty:*</exclude>
-                    <!-- We use reload4j, avoid all log4j 1.x implementations -->
+                    <!-- We use reload4j, exclude log4j 1.x and 2.x -->
                     <exclude>org.apache.logging.log4j:log4j-slf4j-impl</exclude>
                     <exclude>org.apache.logging.log4j:log4j-1.2-api</exclude>
-                    <exclude>log4j:log4j</exclude>
+                    <exclude>log4j:*</exclude>
                     <exclude>org.slf4j:slf4j-log4j12</exclude>
                     <!-- IMPALA-9108: Avoid pulling in leveldbjni, which is unneeded. -->
                     <exclude>org.fusesource.leveldbjni:*</exclude>
@@ -1163,23 +1068,4 @@ under the License.
       </properties>
     </profile>
   </profiles>
-
-  <dependencyManagement>
-    <dependencies>
-      <!--
-      Pin org.glassfish:javax.el explicitly.
-
-      HBase depends on this indirectly, and it's configured with
-      a range of versions. This causes Maven to talk to all configured
-      repositories, leading both to a lot of chattiness, and also
-      failures if one of the repositories is unavailable.
-      -->
-      <dependency>
-        <groupId>org.glassfish</groupId>
-        <artifactId>javax.el</artifactId>
-        <version>3.0.1-b08</version>
-      </dependency>
-
-    </dependencies>
-  </dependencyManagement>
 </project>
diff --git a/java/TableFlattener/pom.xml b/java/TableFlattener/pom.xml
index 439ce6bef..d1195ae3d 100644
--- a/java/TableFlattener/pom.xml
+++ b/java/TableFlattener/pom.xml
@@ -49,25 +49,15 @@
       <artifactId>hadoop-client</artifactId>
       <version>${hadoop.version}</version>
     </dependency>
-    <dependency>
-      <groupId>org.apache.avro</groupId>
-      <artifactId>avro</artifactId>
-      <version>${avro.version}</version>
-    </dependency>
     <dependency>
       <groupId>org.apache.parquet</groupId>
       <artifactId>parquet-avro</artifactId>
-      <version>${parquet.version}</version>
     </dependency>
     <dependency>
       <groupId>org.kitesdk</groupId>
       <artifactId>kite-data-core</artifactId>
       <version>${kite.version}</version>
       <exclusions>
-        <exclusion>
-          <groupId>org.apache.avro</groupId>
-          <artifactId>avro</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>com.twitter</groupId>
           <artifactId>parquet-avro</artifactId>
diff --git a/java/datagenerator/pom.xml b/java/datagenerator/pom.xml
index 9b58b5051..16b9c1128 100644
--- a/java/datagenerator/pom.xml
+++ b/java/datagenerator/pom.xml
@@ -33,30 +33,11 @@ under the License.
   <name>Test Data Generator</name>
 
   <dependencies>
-    <!-- Force json-smart dependency.
-     See https://issues.apache.org/jira/browse/HADOOP-14903 -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>com.google.guava</groupId>
-      <artifactId>guava</artifactId>
-      <version>${guava.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-common</artifactId>
       <version>${hadoop.version}</version>
       <exclusions>
-        <!-- https://issues.apache.org/jira/browse/HADOOP-14903 -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>
           <artifactId>*</artifactId>
@@ -77,22 +58,9 @@ under the License.
       </exclusions>
     </dependency>
 
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
-      <version>${slf4j.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.parquet</groupId>
       <artifactId>parquet-avro</artifactId>
-      <version>${parquet.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>org.apache.avro</groupId>
-      <artifactId>avro</artifactId>
-      <version>${avro.version}</version>
     </dependency>
 
     <dependency>
@@ -100,10 +68,6 @@ under the License.
       <artifactId>kite-data-core</artifactId>
       <version>${kite.version}</version>
       <exclusions>
-        <exclusion>
-          <groupId>org.apache.avro</groupId>
-          <artifactId>avro</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>com.twitter</groupId>
           <artifactId>parquet-avro</artifactId>
diff --git a/java/executor-deps/pom.xml b/java/executor-deps/pom.xml
index e187a8562..232e8ef1f 100644
--- a/java/executor-deps/pom.xml
+++ b/java/executor-deps/pom.xml
@@ -44,14 +44,6 @@ under the License.
   <name>Impala Executor Dependencies</name>
 
   <dependencies>
-
-    <!-- Pin json-smart dependency. -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-hdfs-client</artifactId>
@@ -63,11 +55,6 @@ under the License.
       <artifactId>hadoop-common</artifactId>
       <version>${hadoop.version}</version>
       <exclusions>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>
           <artifactId>*</artifactId>
@@ -85,10 +72,6 @@ under the License.
           <groupId>com.sun.jersey</groupId>
           <artifactId>jersey-servlet</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>log4j</groupId>
           <artifactId>log4j</artifactId>
@@ -117,10 +100,6 @@ under the License.
           <groupId>org.eclipse.jetty</groupId>
           <artifactId>*</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>log4j</groupId>
           <artifactId>log4j</artifactId>
@@ -150,25 +129,11 @@ under the License.
       <groupId>org.apache.hbase</groupId>
       <artifactId>hbase-client</artifactId>
       <version>${hbase.version}</version>
-      <exclusions>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
 
     <dependency>
       <groupId>org.apache.hbase</groupId>
       <artifactId>hbase-common</artifactId>
-      <exclusions>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
-      </exclusions>
       <version>${hbase.version}</version>
     </dependency>
 
diff --git a/java/ext-data-source/sample/pom.xml b/java/ext-data-source/sample/pom.xml
index 8e1ec9744..a0470bbbe 100644
--- a/java/ext-data-source/sample/pom.xml
+++ b/java/ext-data-source/sample/pom.xml
@@ -40,7 +40,6 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
-      <version>${guava.version}</version>
     </dependency>
   </dependencies>
 
diff --git a/java/ext-data-source/test/pom.xml b/java/ext-data-source/test/pom.xml
index 2e1f9fe33..ab705312b 100644
--- a/java/ext-data-source/test/pom.xml
+++ b/java/ext-data-source/test/pom.xml
@@ -40,7 +40,6 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava</artifactId>
-      <version>${guava.version}</version>
     </dependency>
   </dependencies>
 
diff --git a/java/pom.xml b/java/pom.xml
index c734a21bb..b4e75a17f 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -55,6 +55,7 @@ under the License.
     <kudu.version>${env.IMPALA_KUDU_VERSION}</kudu.version>
     <commons-io.version>2.6</commons-io.version>
     <slf4j.version>2.0.3</slf4j.version>
+    <reload4j.version>1.2.22</reload4j.version>
     <junit.version>4.12</junit.version>
     <!-- Beware compatibility requirements with Thrift and
          KMS; see IMPALA-4210. -->
@@ -73,7 +74,7 @@ under the License.
          but they are needed by pac4j. This uses a newer xmlsec/spring to address CVEs,
          but bcprov-jdk15on matches the versions from pac4j 4.5.5. -->
     <xmlsec.version>2.2.3</xmlsec.version>
-    <bcprov-jdk15on.version>1.68</bcprov-jdk15on.version>
+    <bouncy-castle.version>1.68</bouncy-castle.version>
     <springframework.version>5.3.20</springframework.version>
     <json-smart.version>2.4.7</json-smart.version>
   </properties>
@@ -251,6 +252,114 @@ under the License.
     </pluginRepository>
   </pluginRepositories>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>net.minidev</groupId>
+        <artifactId>json-smart</artifactId>
+        <version>${json-smart.version}</version>
+      </dependency>
+
+      <!--
+      Pin org.glassfish:javax.el explicitly.
+
+      HBase depends on this indirectly, and it's configured with
+      a range of versions. This causes Maven to talk to all configured
+      repositories, leading both to a lot of chattiness, and also
+      failures if one of the repositories is unavailable.
+      -->
+      <dependency>
+        <groupId>org.glassfish</groupId>
+        <artifactId>javax.el</artifactId>
+        <version>3.0.1-b08</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.apache.avro</groupId>
+        <artifactId>avro</artifactId>
+        <version>${avro.version}</version>
+      </dependency>
+
+      <!-- Override httpcore from libthrift to a later maintenance version. Noticed
+          certain SPNEGO auth errors when connecting to kerberized HTTP endpoints
+          using v4.4.1 pulled by libthrift. -->
+      <dependency>
+        <groupId>org.apache.httpcomponents</groupId>
+        <artifactId>httpcore</artifactId>
+        <version>${httpcomponents.core.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.apache.parquet</groupId>
+        <artifactId>parquet-avro</artifactId>
+        <version>${parquet.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.apache.santuario</groupId>
+        <artifactId>xmlsec</artifactId>
+        <version>${xmlsec.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcprov-jdk15on</artifactId>
+        <version>${bouncy-castle.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.bouncycastle</groupId>
+        <artifactId>bcpkix-jdk15on</artifactId>
+        <version>${bouncy-castle.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.pac4j</groupId>
+        <artifactId>pac4j-core</artifactId>
+        <version>${pac4j.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>ch.qos.reload4j</groupId>
+        <artifactId>reload4j</artifactId>
+        <version>${reload4j.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>jcl-over-slf4j</artifactId>
+        <version>${slf4j.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-api</artifactId>
+        <version>${slf4j.version}</version>
+      </dependency>
+      <!-- Later versions of slf4j-log4j12 map to slf4j-reload4j. This is the simplest
+           way to ensure any instances of slf4j-log4j12 are mapped to slf4j-reload4j. -->
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-log4j12</artifactId>
+        <version>${slf4j.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-reload4j</artifactId>
+        <version>${slf4j.version}</version>
+      </dependency>
+
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-core</artifactId>
+        <version>${springframework.version}</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <modules>
     <module>datagenerator</module>
     <module>executor-deps</module>
diff --git a/java/shaded-deps/hive-exec/pom.xml b/java/shaded-deps/hive-exec/pom.xml
index 499852614..1b157ae91 100644
--- a/java/shaded-deps/hive-exec/pom.xml
+++ b/java/shaded-deps/hive-exec/pom.xml
@@ -35,14 +35,6 @@ the same dependencies
   <packaging>jar</packaging>
 
   <dependencies>
-    <!-- Pin json-smart dependency.
-         (this is not included in the shaded jar) -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.hive</groupId>
       <artifactId>hive-exec</artifactId>
@@ -52,11 +44,6 @@ the same dependencies
           <groupId>org.apache.hive.shims</groupId>
           <artifactId>hive-shims-0.20</artifactId>
         </exclusion>
-        <!-- Exclude json-smart to pin the version -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.apache.atlas</groupId>
           <artifactId>*</artifactId>
diff --git a/java/test-hive-udfs/pom.xml b/java/test-hive-udfs/pom.xml
index c319acbfa..59f7b4b22 100644
--- a/java/test-hive-udfs/pom.xml
+++ b/java/test-hive-udfs/pom.xml
@@ -37,35 +37,16 @@ under the License.
   </properties>
 
   <dependencies>
-    <!-- Force json-smart dependency.
-     See https://issues.apache.org/jira/browse/HADOOP-14903 -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-common</artifactId>
       <version>${hadoop.version}</version>
-      <exclusions>
-        <!-- https://issues.apache.org/jira/browse/HADOOP-14903 -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.hive</groupId>
       <artifactId>hive-exec</artifactId>
       <version>${hive.version}</version>
       <exclusions>
-        <!-- https://issues.apache.org/jira/browse/HADOOP-14903 -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.apache.hive.shims</groupId>
           <artifactId>hive-shims-0.20</artifactId>
diff --git a/java/yarn-extras/pom.xml b/java/yarn-extras/pom.xml
index 368273afc..1d3b7924b 100644
--- a/java/yarn-extras/pom.xml
+++ b/java/yarn-extras/pom.xml
@@ -32,30 +32,11 @@
   <url>.</url>
 
   <dependencies>
-    <!-- Force json-smart dependency.
-         See https://issues.apache.org/jira/browse/HADOOP-14903 -->
-    <dependency>
-      <groupId>net.minidev</groupId>
-      <artifactId>json-smart</artifactId>
-      <version>${json-smart.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>com.google.guava</groupId>
-      <artifactId>guava</artifactId>
-      <version>${guava.version}</version>
-    </dependency>
-
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-common</artifactId>
       <version>${hadoop.version}</version>
       <exclusions>
-        <!-- https://issues.apache.org/jira/browse/HADOOP-14903 -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>
           <artifactId>*</artifactId>
@@ -87,11 +68,6 @@
       <artifactId>hadoop-yarn-common</artifactId>
       <version>${hadoop.version}</version>
       <exclusions>
-        <!-- https://issues.apache.org/jira/browse/HADOOP-14903 -->
-        <exclusion>
-          <groupId>net.minidev</groupId>
-          <artifactId>json-smart</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>com.sun.jersey</groupId>
           <artifactId>jersey-server</artifactId>